Implement forward sealing of firmware upgrades

Sharing @marmarek idea posted here:

High level effect: preserve TOTP/HTOP secret, _if the firmware update is
properly signed_. This include two things:
 - verifying firmware update signature (probably independently of
   coreboot's vboot)
 - if signature is ok, calculate expected PCRs values of the new firmware
   and seal the secret to them

This "forward sealing" is supported by OpenXT, so it may be a good idea
to take a look at how they do that in details. Some documentation is
here:
https://openxt.atlassian.net/wiki/spaces/TEST/pages/76910241/Forward+Seal+Test+Procedures
https://openxt.atlassian.net/wiki/spaces/DC/pages/77302339/TPM+2.0
(AFAIR they had this for TPM 1.2 too)
The actual script for this (OpenXT specific):
https://github.com/OpenXT/xenclient-oe/blob/master/recipes-openxt/openxt-measuredlaunch/openxt-measuredlaunch/seal-system

If you'd like to tackle this, I can connect you with OpenXT people
and/or forward some questions.

Start by reading the OpenXT forward-seal documentation and the linked seal-system script, then review the referenced discussion in pull request #511. The issue considers firmware signature verification and sealing secrets to expected PCR values; done would require a defined design and implementation covering both parts.